XSS-Dec: A Hybrid Solution to Mitigate Cross-Site Scripting Attacks

Abstract

Abstract. Cross-site scripting attacks represent one of the major security threats in today's Web applications. Current approaches to mitigate cross-site scripting vulnerabilities rely on either server-based or client-based defense mechanisms. Although effective for many attacks, server-side protection mechanisms may leave the client vulnerable if the server is not well patched. On the other hand, client-based mechanisms may incur a significant overhead on the client system. In this work, we present a hybrid client-server solution that combines the benefits of both architectures. Our Proxy-based solution leverages the strengths of both anomaly detection and control flow analysis to provide accurate detection. We demonstrate the feasibility and accuracy of our approach through extended testing using real-world cross-site scripting exploits.

Precise XSS detection and mitigation with Client-side Templates

“…Client and server hybrids. XSS-Dec [39] uses a proxy which keeps track of an encrypted version of the server's source files, and applies this information to derive exploits in a page visited by the user. This approach is similar to ours, since we assume previous knowledge of the clean HTML document.…”

“…Informally, the cause of XSS is a lack of input sanitization: user-chosen data "escapes" into a page's template and makes its way into the JavaScript engine, or modifies the DOM. Consequently, many of the XSS defenses published so far propose to fix the problem at the source, by properly separating the template from the user data on the server, or by modifying browsers [26,30,39,40]. There are also similar solutions that can be implemented in the front-end code of an application [25].…”

SPHERES: an efficient server-side web application protection system

“…For example, there are many detection and prevention methods of SQL injection, they are either signature-based such in Shanmughaneethi et al (2009), behaviour-based (Pinzón et al, 2013), grammar-based (Bisht et al, 2010;Kemalis and Tzouramanis, 2008), or taint-based (Jan et al, 2010;Alazab et al, 2011;Tateishi and Tabuchi, 2007;Papagiannis et al, 2011). The XSS detection and prevention methods are also categorised in the same way as the SQL injection detection and prevention methods, they are either signaturebased (Shanmughaneethi et al, 2009), or behaviour-based (Sundareswaran and Squicciarini, 2012), or grammar-based (Chandra and Selvakumar, 2011), or taint-based (Avancini and Ceccato, 2010). In order to protect against CSRF attacks (also known as XSRF, 'sea surf', session riding, CSRF, hostile linking, and one-click attack), OWASP developed a server-side CSRF protection mechanism for Apache (called mod_csrfprotector), Java (called CSRFGuard) and PHP (called CSRF-protector-PHP).…”